# Elastic agent Windows integration issue **URL:** \ **Category:** Elastic Agent\ **Tags:** winlogbeat, integrations\ **Created:** [August 5, 2025, 8:28pm UTC](https://discuss.elastic.co/t/elastic-agent-windows-integration-issue/380771 "2025-08-05T20:28:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![f4n-1nh1b1t10n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f4n-1nh1b1t10n/32/144539_2.png) [@f4n-1nh1b1t10n](https://discuss.elastic.co/u/f4n-1nh1b1t10n)\ **Post date:** [August 5, 2025, 8:28pm UTC](https://discuss.elastic.co/t/elastic-agent-windows-integration-issue/380771/1 "2025-08-05T20:28:32Z")
Hello, first post here. Short description of the current environment: - kibana and elasticsearch on 1 host (virtualized in a vbox) - standalone elastic agent on another host (a windows laptop) with Windows (v3.1.0) & system (v2.5.2) integration - the stack and the agent are all running version 8.19.0 - the laptop runs the agent and sysmon as a service I've defined an agent policy in kibana. Added the integration for windows and system. Used the config YML it produces for the elastic agent. The system metrics integration seems to work OK. I'm having trouble however with the Windows modules: ```auto Input 'winlog' failed with: input winlog-windows.sysmon_operational-18936846-6fdf-4c10-b3e8-e2cb8b32ed367 failed: input **panic** with: name winlog-windows_sysmon_operational-18936846-6fdf-4c10-b3e8-e2cb8b32ed367 already used goroutine 121 [running]: runtime/debug.Stack() runtime/debug/stack.go:26 +0x5e github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource.func1() github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:172 +0x58 panic({0x84afae0?, 0xc0031d39a0?}) runtime/panic.go:792 +0x132 github.com/elastic/elastic-agent-libs/monitoring.panicErr(...) github.com/elastic/elastic-agent-libs@v0.20.0/monitoring/registry.go:287 github.com/elastic/elastic-agent-libs/monitoring.(*Registry).Add(0xc0023f1340, {0xc0019dacd0?, 0xc0031da9c0?}, {0xa5afaa0, 0xc0031cee00}, 0x0?) github.com/elastic/elastic-agent-libs@v0.20.0/monitoring/registry.go:185 +0xca github.com/elastic/elastic-agent-libs/monitoring.(*Registry).NewRegistry(0xc0023f1340, {0xc0019dacd0, 0x47}, {0x0?, 0xa587628?, 0x1?}) github.com/elastic/elastic-agent-libs@v0.20.0/monitoring/registry.go:94 +0x155 github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewInputRegistry({0x96e8106, 0x6}, {0xc0000b02d0, 0x47}, 0x0) github.com/elastic/beats/v7/libbeat/monitoring/inputmon/input.go:73 +0x36f github.com/elastic/beats/v7/winlogbeat/eventlog.newInputMetrics({0xc002132a80, 0x24}, {0xc0000b02d0?, 0xc0031a5420?}) github.com/elastic/beats/v7/winlogbeat/eventlog/wineventlog.go:688 +0x56 github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).Open(0xc0001076c0, {{0x0, 0x0}, 0x0, {0x0, 0x0, 0x0}, {0x0, 0x0}}) github.com/elastic/beats/v7/winlogbeat/eventlog/wineventlog.go:334 +0x9f github.com/elastic/beats/v7/winlogbeat/eventlog.Run({0xa5bb280, 0xc0031a6dc0}, {0xa652bc8, 0xc0026218b0}, {0xa6712d0, 0xc0001076c0}, {{0x0, 0x0}, 0x0, {0x0, ...}, ...}, ...) github.com/elastic/beats/v7/winlogbeat/eventlog/runner.go:80 +0x331 github.com/elastic/beats/v7/filebeat/input/winlog.winlogInput.Run({}, {0xc0031abec0, {0xc001d341b0, 0x90}, {0xc0000b02d0, 0x47}, {0x96e8106, 0x6}, {{0x96f117b, 0x8}, ...}, ...}, ...) github.com/elastic/beats/v7/filebeat/input/winlog/input.go:103 +0x3ff github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource(_, {0xc0031abec0, {0xc001d341b0, 0x90}, {0xc0000b02d0, 0x47}, {0x96e8106, 0x6}, {{0x96f117b, 0x8}, ...}, ...}, ...) github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:196 +0x483 github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).Run.func1() github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:151 +0x2f2 github.com/elastic/go-concert/unison.(*MultiErrGroup).Go.func1() github.com/elastic/go-concert@v0.3.0/unison/multierrgroup.go:42 +0x66 created by github.com/elastic/go-concert/unison.(*MultiErrGroup).Go in goroutine 342 github.com/elastic/go-concert@v0.3.0/unison/multierrgroup.go:40 +0x76 ``` The same error is produced for all Windows modules that were enabled. there is only 1 instance of the agent running. I've looked at [Winlogbeat Fatal Error 8.7.0+ name already used - Elastic Stack / Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/winlogbeat-fatal-error-8-7-0-name-already-used/337093/11) and ids from the generated yml all seem to be different. Can someone help me? Thanks a lot. EDIT: Some extra information. ![Screenshot 2025-08-06 171909](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2edfa11a6c95a1befd4e9fc56493c5d653611a1f.png) Seems like the handle is not closing. EDIT 2: Thinking it's a **unique-id-config** issue, i uninstalled the agent. installed winlogbeat, and a similar panic error prevented me from starting it. But, this issue was already discussed in [Winlogbeat Fatal Error 8.7.0+ name already used - Elastic Stack / Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/winlogbeat-fatal-error-8-7-0-name-already-used/337093/14). In the winlogbeat yaml, you can in a clean way add a unique id to each event log you want to ingest, like so: ```auto - name: Microsoft-Windows-Sysmon/Operational id: sysmon-logs ``` So, given i'm not using the advantages of fleet, i'm inclined to switch over to winlogbeat, even though the agent can still be used for metrics and other event types (currently not concerned with the overhead that 2 separate beats produce). ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [August 11, 2025, 10:03am UTC](https://discuss.elastic.co/t/elastic-agent-windows-integration-issue/380771/2 "2025-08-11T10:03:51Z")
FYI, I think you’re seeing the bug that this PR addresses: [Fix panic in winlog input by faec · Pull Request #45730 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/45730) ---
**Author:** ![f4n-1nh1b1t10n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f4n-1nh1b1t10n/32/144539_2.png) [@f4n-1nh1b1t10n](https://discuss.elastic.co/u/f4n-1nh1b1t10n)\ **Post date:** [August 11, 2025, 4:07pm UTC](https://discuss.elastic.co/t/elastic-agent-windows-integration-issue/380771/3 "2025-08-11T16:07:53Z")
Hallo, thank you I am aware it was due to a bug. Kr